4 ms·

I'm using a similar setup on macOS, except mine does not use modifier keys; it just logs me out. YubiCo even provides the documentation to set it up via OpenSC

by Fnoord 7y ago

I'm using a similar setup on macOS, except mine does not use modifier keys; it just logs me out. YubiCo even provides the documentation to set it up via OpenSC. I guess you can also set macOS up to hibernate and destroy the FileVault key. (My adversary is not government etc (who can execute a cold boot attack anyway), it is thieves while I'm in transit, and clients around the office.)

miles 7y ago
Just curious; is this the Yubico guide you're referring to? macOS Logon Tool Configuration Guide https://support.yubico.com/support/solutions/articles/15000015045-macos-logon-tool-configuration-guide https://support.yubico.com/support/solutions/articles/150000... Unfortunately, it's not currently compatible with Catalina. Here are a few more resources for macOS users: Simple Daemon for lock and unlock macOS with Yubikey https://podtynnyi.com/2017/03/07/simple-daemon-for-lock-and-unlock-macos-with-yubikey/ https://podtynnyi.com/2017/03/07/simple-daemon-for-lock-and-... Locking macOS to a Yubikey 4 with PIV and PAM https://www.richard-purves.com/2017/02/13/locking-macos-with-yubikey-4-piv-and-pam/ https://www.richard-purves.com/2017/02/13/locking-macos-with... HOW to lock and unlock screen upon removal and insertion of Yubikey on macOS https://confluence.panio.info/display/PUBL/HOW+to+lock+and+unlock+screen+upon+removal+and+insertion+of+Yubikey+on+macOS https://confluence.panio.info/display/PUBL/HOW+to+lock+and+u...
- Fnoord 7y ago
  No, that guide uses PAM and OTP. This [1] is the guide. It uses OpenSC and the smartcard feature of the YubiKey (not all support this but my YubiKey Neo (3rd gen) and YubiKey Nano 4 both do). Neither of them supports FIDO2 though; other than that they are feature rich. [1] https://support.yubico.com/support/solutions/articles/15000006468-using-your-yubikey-as-a-smart-card-in-macos https://support.yubico.com/support/solutions/articles/150000...
  - miles 7y ago
    Thanks so much for your reply, Fnoord. Does that approach allow instantly locking the screen if the YubiKey is removed? It's not mentioned in the guide, so I just want to be sure.
    - Fnoord 7y ago
      Yes, it does, though I had to set it to lock immediately in System Preferences (triggers immediately the screensaver; first guide you linked explains how to do this). I'm using the Word Of The Day screensaver, so it is really inspiring to get back from grabbing a cup of coffee. Also, remember you only need to enter the PIN, which I'd argue is a good thing as I don't want to enter my password in public (I don't even know my password out of my head). If you boot up, you need a password of a username to unlock FileVault, but I use a different username for that (who does not have root, though for forensics this is an attack vector).
      - Fnoord 7y ago
        And enable "Turn on screensaver when login token is removed" at System Preferences -> Security & Privacy -> General -> Advanced

by Fnoord 7y ago

miles 7y ago

Just curious; is this the Yubico guide you're referring to? macOS Logon Tool Configuration Guide https://support.yubico.com/support/solutions/articles/15000015045-macos-logon-tool-configuration-guide https://support.yubico.com/support/solutions/articles/150000... Unfortunately, it's not currently compatible with Catalina. Here are a few more resources for macOS users: Simple Daemon for lock and unlock macOS with Yubikey https://podtynnyi.com/2017/03/07/simple-daemon-for-lock-and-unlock-macos-with-yubikey/ https://podtynnyi.com/2017/03/07/simple-daemon-for-lock-and-... Locking macOS to a Yubikey 4 with PIV and PAM https://www.richard-purves.com/2017/02/13/locking-macos-with-yubikey-4-piv-and-pam/ https://www.richard-purves.com/2017/02/13/locking-macos-with... HOW to lock and unlock screen upon removal and insertion of Yubikey on macOS https://confluence.panio.info/display/PUBL/HOW+to+lock+and+unlock+screen+upon+removal+and+insertion+of+Yubikey+on+macOS https://confluence.panio.info/display/PUBL/HOW+to+lock+and+u...

Fnoord 7y ago
No, that guide uses PAM and OTP. This [1] is the guide. It uses OpenSC and the smartcard feature of the YubiKey (not all support this but my YubiKey Neo (3rd gen) and YubiKey Nano 4 both do). Neither of them supports FIDO2 though; other than that they are feature rich. [1] https://support.yubico.com/support/solutions/articles/15000006468-using-your-yubikey-as-a-smart-card-in-macos https://support.yubico.com/support/solutions/articles/150000...
- miles 7y ago
  Thanks so much for your reply, Fnoord. Does that approach allow instantly locking the screen if the YubiKey is removed? It's not mentioned in the guide, so I just want to be sure.
  - Fnoord 7y ago
    Yes, it does, though I had to set it to lock immediately in System Preferences (triggers immediately the screensaver; first guide you linked explains how to do this). I'm using the Word Of The Day screensaver, so it is really inspiring to get back from grabbing a cup of coffee. Also, remember you only need to enter the PIN, which I'd argue is a good thing as I don't want to enter my password in public (I don't even know my password out of my head). If you boot up, you need a password of a username to unlock FileVault, but I use a different username for that (who does not have root, though for forensics this is an attack vector).
    - Fnoord 7y ago
      And enable "Turn on screensaver when login token is removed" at System Preferences -> Security & Privacy -> General -> Advanced